4 ms·

It’s also not clear why the IM project should be paying MS and not the other way round…

lodovic 3y ago
But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.
- sime2009 3y ago
  Look at it this way, why should a project like IM pay MicroSoft for the privilege of enriching and adding value to the Windows platform?
  - layer8 3y ago
    The fee for code signing certificates doesn't go to Microsoft.
    - sime2009 3y ago
      Who actually receives the money is not relevant to my core point.
      - kenjackson 3y ago
        If it’s not relevant to your point, can you make your point without stating something that is false?
        sime2009 3y ago
        "Look at it this way, why should a project like IM pay anyone for the privilege of enriching and adding value to the Windows platform?"
        kenjackson 3y ago
        They aren’t adding value to the Windows platform, unless you consider any application is adding value to the platform it is running on. In which case why should one pay for dev tools, their dev computer, libraries, art assets, etc…
      - rat9988 3y ago
        Because Ms hasn't asked for it.
        sime2009 3y ago
        Of course MS asked for it. They created and sustain this situation where software needs to signed for it to easily run on the Windows platform. Who do you think put the signature checking code and root keys in Windows?? The code signing gnomes?? fairies??
        justinclift 3y ago
        Seems more like the work of gremlins or devils. ;)
        rat9988 3y ago
        They didn't ask for ImageMagick. Would they have asked ImageMagick to develop the software for their platform to enrich it, I would have agreed that they should pay. Otherwise anyone can say I enrich your ecosystem so pay me.
- kergonath 3y ago
  This does not solve the problem at all, and does not improve security either. Microsoft themselves could perfectly well have the same analysis in-house and provide free certificates to properly vetted projects. Adding layers of middlemen to deal with is a pain in the backside and a consequence is that some projects will just not bother. It’s inefficient on all levels and still does not protect from bad actors.
  - mike_hearn 3y ago
    They practically do. Distribute via the MS Store and they'll sign your software using Microsoft keys, and it costs you $19 once. It's the best way for ImageMagick to resolve their cost issue.
deleted 3y ago
[deleted]
vasdae 3y ago
MS does not sell certificates.
- Zuiii 3y ago
  It's the one mandating them and not offering acceptable alternatives.
  - pl4nty 3y ago
    they do offer an alternative, Azure Code Signing (ie cloud HSM). ImageMagick are looking at moving to it. it's free but someone difficult to access, due to the identity verification requirements
- gloosx 3y ago
  The cartel leaders don't sell drugs, street pushers do. MS just have to sell licenses to sell certificates.
keepamovin 3y ago
Yeah, I mean people should definitely be paying ImageMagick. Or perhaps it's more true to say, "ImageMagick should definitely figure out a way to become a business."

But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.

sime2009 3y ago
Look at it this way, why should a project like IM pay MicroSoft for the privilege of enriching and adding value to the Windows platform?
- layer8 3y ago
  The fee for code signing certificates doesn't go to Microsoft.
  - sime2009 3y ago
    Who actually receives the money is not relevant to my core point.
    - kenjackson 3y ago
      If it’s not relevant to your point, can you make your point without stating something that is false?
      - sime2009 3y ago
        "Look at it this way, why should a project like IM pay anyone for the privilege of enriching and adding value to the Windows platform?"
        kenjackson 3y ago
        They aren’t adding value to the Windows platform, unless you consider any application is adding value to the platform it is running on. In which case why should one pay for dev tools, their dev computer, libraries, art assets, etc…
    - rat9988 3y ago
      Because Ms hasn't asked for it.
      - sime2009 3y ago
        Of course MS asked for it. They created and sustain this situation where software needs to signed for it to easily run on the Windows platform. Who do you think put the signature checking code and root keys in Windows?? The code signing gnomes?? fairies??
        justinclift 3y ago
        Seems more like the work of gremlins or devils. ;)
        rat9988 3y ago
        They didn't ask for ImageMagick. Would they have asked ImageMagick to develop the software for their platform to enrich it, I would have agreed that they should pay. Otherwise anyone can say I enrich your ecosystem so pay me.
kergonath 3y ago
This does not solve the problem at all, and does not improve security either. Microsoft themselves could perfectly well have the same analysis in-house and provide free certificates to properly vetted projects. Adding layers of middlemen to deal with is a pain in the backside and a consequence is that some projects will just not bother. It’s inefficient on all levels and still does not protect from bad actors.
- mike_hearn 3y ago
  They practically do. Distribute via the MS Store and they'll sign your software using Microsoft keys, and it costs you $19 once. It's the best way for ImageMagick to resolve their cost issue.

deleted 3y ago

[deleted]

vasdae 3y ago

MS does not sell certificates.

Zuiii 3y ago
It's the one mandating them and not offering acceptable alternatives.
- pl4nty 3y ago
  they do offer an alternative, Azure Code Signing (ie cloud HSM). ImageMagick are looking at moving to it. it's free but someone difficult to access, due to the identity verification requirements
gloosx 3y ago
The cartel leaders don't sell drugs, street pushers do. MS just have to sell licenses to sell certificates.

keepamovin 3y ago

Yeah, I mean people should definitely be paying ImageMagick. Or perhaps it's more true to say, "ImageMagick should definitely figure out a way to become a business."